In My Stash Security Architecture

How In My Stash connects to banks read-only, encrypts everything, and is designed so that no party — including us — holds more of your financial data than strictly necessary.

1. Design philosophy

In My Stash answers one question — "stash it, or spend it?" — from your real bank balance. To do that it needs to read your balances and transactions. Everything in the design flows from three principles:

• Read-only. In My Stash never has the ability to move money.
• Data minimization. We store the least possible, for the shortest time. Financial data is never persisted on our servers.
• Encryption by default. In transit and at rest, with the most sensitive secret (the bank access token) protected so that we cannot use it unattended.

2. Components

3. Connection flows

In My Stash supports two read-only aggregators. In both, the user authenticates directly with their bank — In My Stash never receives bank credentials — and the result is a read-only access credential held encrypted by the relay.

3.1 Plaid

1. The relay requests a Plaid link_token using server-side Plaid credentials.
2. The user completes Plaid Link — logging into their bank (with the bank's own MFA) inside Plaid's interface.
3. Plaid returns a short-lived public_token; the relay exchanges it for a long-lived read-only access_token.
4. The access token is encrypted and stored; balances/transactions are fetched on demand and returned to the device.

3.2 SimpleFIN

1. The user connects their bank at the SimpleFIN Bridge and obtains a one-time setup token.
2. The relay claims the setup token for a read-only access URL.
3. The access URL is encrypted and stored; balances/transactions are fetched on demand and returned to the device.

SimpleFIN is read-only by architecture — it can report data but cannot move money. Plaid access is scoped to read-only products only (Transactions and Balance).

4. Encryption & key model

4.1 In transit

All communication uses TLS 1.2 or better — between the app and the relay, the relay and the aggregators, and the app and its encrypted backup destination.

4.2 At rest — the relay

Every record stored in the relay's KV is encrypted with AES-256-GCM under a master key held only as a platform secret. There is no plaintext at rest — not institution names, not masked account numbers.

The bank access credential carries an additional envelope:

Because the inner layer requires the device's key, the relay is on-demand: it can read a user's finances only while that user is actively using the app, and never unattended.

4.3 At rest — the device

Financial data lives on the user's device. With the app lock enabled, the on-device store is encrypted with AES-GCM. Optional encrypted backup is end-to-end encrypted before it leaves the device; In My Stash cannot read it and does not hold the key.

5. Data minimization & retention

• No financial data on our servers. Transactions and balances are relayed once to the device and never persisted server-side.
• No consumer PII collected. Identity is a random on-device capability secret — no name, email, or account required to use the app.
• Token retention. The relay keeps only the encrypted read-only token while the connection is active; disconnecting deletes it.
• Logs contain request metadata only — never financial data.

6. Access control & operations

• Administrative consoles (Cloudflare, GitHub, Plaid, SimpleFIN) require multi-factor authentication and least-privilege access.
• Machine-to-machine authentication uses scoped, expiring API credentials and per-user bearer tokens over TLS — never global keys.
• Secrets are stored only as platform secrets, never in source; any suspected exposure triggers immediate rotation.
• Production runs on managed serverless infrastructure, so operating-system and runtime patching is handled continuously by the provider. Application dependencies are reviewed each release under a defined patch SLA.

7. Compliance posture

• GLBA Safeguards-aligned: encryption in transit and at rest, least-privilege access, data minimization, and an incident-response process.
• CCPA/CPRA and U.S. state privacy laws: notice at collection, no sale or sharing, and a working export/delete path — applied to all users regardless of residence.
• Not financial advice. In My Stash is a decision tool, not a licensed advisor.

Detailed internal policies are summarized on the Security Policies page and available to partners and auditors on request.

8. Incident response

On suspected compromise we (1) rotate affected secrets, (2) revoke affected tokens/connections, (3) assess scope from logs, (4) notify affected users where their data may be affected, and (5) meet applicable breach-notification duties. By design, a relay compromise exposes no financial data and no usable token.

Contact security@inmystash.com for security questions, partner due-diligence, or vulnerability reports.